This Data Protection Information informs about the processing of your Personal Data in connection with the CATchup website (www.puma-catchup.com) and its sub-pages of PUMA SE (hereinafter “PUMA”, “we” or “us”) in accordance with the EU General Data Protection Regulation (hereinafter “GDPR”).

1. Scope, Controller, Data Protection Officer and definitions

Scope of this Data Protection Information
This Data Protection Information applies to direct visits of the CATchup website (https://www.puma-catchup.com) and its sub-pages via your web browser as well as the usage of the PUMA CATchup app, which displays the content of the CATchup web pages specially prepared for mobile devices.

Controller
Unless otherwise stated in this Data Protection Information, the responsible Controller for data processing within the scope of this Data Protection Information is:

PUMA SE
PUMA Way 1
91074 Herzogenaurach
Germany

Contact details of Data Protection Officer
Please direct any questions regarding data protection to:

Datenschutzbeauftragter
PUMA SE
PUMA Way 1
91074 Herzogenaurach
E-Mail: dataprotection[at]puma.com

Definitions
This Data Protection Information is based on the following terms under data protection law, which we have defined to facilitate understanding.

GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Recipient means a natural person or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular enquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by the public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing; Examples of possible recipients: IT services providers or adverting partners; for more information please refer to Section 5.

PUMA Group means all enterprises that are affiliated with PUMA SE pursuant to Section 15 Aktiengesetz [German Stock Corporation Act].

Personal Data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Examples of personal data: Name, contact details, IP addresses.

Controller means the natural person or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. For the data processing activities described in this Data Protection Information, the Controller is PUMA SE.

Processing means any operation or set of operations which is on personal data or on sets of personal data, whether or not by automated means such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2. Purposes, legal bases and, if applicable, data categories of processing your Personal Data

Processing of your data when you visit our website and use the app
If you access our web pages just to inform yourself about PUMA news and/or activate “push notifications” your PUMA CATchup app or otherwise actively transmitting information to us (purely informational usage), we process your Personal Data for the following purposes and on the basis of the following legal bases:

Processing for IT security purposes
When you visit our websites, we process your Personal Data, which is technically necessary for us to provide you with our websites and to ensure stability and security when you visit our websites. For this purpose we process the following Personal Data:

IP address

type and version of browser you are using,

your operating system and platform and

uniform resource locator (URL).

We process your Personal Data on the basis of our legitimate interest in ensuring IT security for you when you visit our websites (legal base: Art. 6 I 1 f) GDPR).

App Permissions
When you use the App, we will ask you for permission to access specific system- and device level functions.

This includes the following permissions:

When you first launch the App, you will be asked to allow the App to send push notifications to keep you up-to-date with the latest news and product drops.

You can change your permissions in your App settings or in your device’s system settings at any time.

3. Analytics and marketing tracking

Use of cookies 
On our website we use cookies. Cookies are small text files that are stored in the browsers of your end devices whenever you visit our websites. Through cookies, your actions and settings on our websites can be tracked, stored and recognized for the duration of the browser session or even after this. In addition to this, cookies and their respective cookie IDs allow your browser to be recognized.

For more information about the use of cookies on our websites, the cookie categories and for individual settings please refer to our Cookie settings.

If your personal data is processed by cookies or other technical measures that store data on your end device or retrieve data from your end device, the legal basis for which in the following passages is consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, you give your consent in accordance with § 25 para. 1 TDDDG (Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten) [German Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services] by activating the services in the cookie banner. The revocation of consent in accordance with § 25 para. 1 TDDDG is also carried out by deactivating the corresponding services in the cookie banner.
 
Google Tag Manager
On our websites, we use the Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

The Google Tag Manager enables PUMA to use so-called website tags via a web-based user interface provided to us by Google.

Website tags are “measurement codes and associated code fragments” that can communicate with Tag Manager servers and be configured through a web-based user interface, Google Tag Manager.

Google Tag Manager also allows us to resolve other website tags that may also collect data.
In order to provide the service, we set a cookie if you have given consent to the activation of the cookie (Art. 6 para. 1, lit. a GDPR).

In the event that your personal data is transferred to Google LLC in the U.S., Google LLC has taken appropriate measures to ensure compliance with the level of data protection requirements applicable in the European Union or the European Economic Area (e.g. certification in the EU-U.S. Data Privacy Framework adopted by the EU Commission; conclusion of standard data protection clauses).

You can find more information about Google Tag Manager on the following Google web pages:

Google Privacy & Terms: https://business.safety.google/privacy/

Privacy Policy: https://policies.google.com/privacy

Google Tag Manager FAQ: https://support.google.com/tagmanager/

Terms of Use Google Tag Manager: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/
 
Google Analytics
We use Google Analytics on our websites, a web analysis service Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“).

Google Analytics uses cookies that allow an analysis to be made on the usage of our websites. The information generated by the cookie on the use of our websites is, as a rule, transferred to a server of Google in the USA, where it is stored.

However, as we use Google Analytics with the extension “anonymizeIP()”, Google will reduce the IP address of the website visitor within Member States of the European Union or in other states party to the Agreement on the European Economic Area beforehand, which excludes any direct association to you. Only in exceptional cases, is the full IP address transferred to a server of Google in the USA and shortened there.

On behalf of PUMA, Google will use this information in order to evaluate the use of the websites, to prepare reports on the website activities and to provide further services to PUMA connected with the use of the websites and of the Internet. The IP address transferred from the user’s browser with regard to Google Analytics is not merged with other data by Google.

Further information on terms of use and data protection can be found under:

https://business.safety.google/privacy/

https://policies.google.com/terms

https://policies.google.com/privacy

https://support.google.com/analytics/answer/9213390?hl=en

The processing of your personal data is based on consent pursuant Art. 6 para. 1 s. 1, lit. a GDPR.

You can give your consent to Google Analytics in our cookie banner. You can revoke this consent at any time with effect for the future by deactivating Google Analytics in our Cookie settings.
If you do not give us your consent to analyze your data using Google Analytics, we will analyze the usage of our website without tracking your personal data with Google Consent Mode. You can find more information about Google Consent Mode in the corresponding passage of this Data Protection Information.

Google Analytics Opt-out:
You can prevent the processing of your usage data (including your IP address) by Google Analytics generally, by downloading and installing the browser add-on available at the following link:

https://tools.google.com/dlpage/gaoptout
 
Google Consent Mode
If you do not give us your consent to analyze your data using Google Analytics, we will not track your personal data.

In these cases, we use the Google Consent Mode of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Consent Mode allows us to carry out an analysis using so-called modeling, which takes place without the use of cookies and without processing your personal data.

To carry out the so-called modeling, we process the following data without personal reference to your visit to our website: Function-related data (timestamp, user agent, referrer URL), aggregated data (Boolean information on the status of consent, random number when building each separate page, references to information on the ad click in the URL in the user’s navigation history of the previous or current page and information on the consent platform used).

Further information on Google Consent Mode can be found at:

https://support.google.com/google-ads/answer/10000067?hl=en

General information on data protection at Google can be found at the following links:

https://business.safety.google/privacy/

https://policies.google.com/privacy
 
Push notifications (App & Web) via OneSignal
In order to send you so-called “push notifications” in your web browser or our app, we use the services of OneSignal, Inc., located at 201 S. B Street, San Mateo, CA 94401, USA.

If you activate the “push notifications” function, we process your device and online identifier (device ID, OneSignal user ID, push token), your browser type, and the operating system of your device, including time zone and, if applicable, app version and your location based on your IP address.

To ensure the proper implementation of the function, we also collect information about your interaction with the messages (distribution and opening of notifications as well as clicks).
The processing of your personal data is based on consent in accordance with Art. 6 para. 1 lit. a GDPR. The processing of your personal data for the technical provision of the service and IT security is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR.

You can give your consent to the delivery of “push notifications” by OneSignal in our Cookie settings. You can revoke this consent at any time with effect for the future by deactivating OneSignal in our Cookie settings. Additionally, you can revoke permissions for push notifications via your browser settings. With regard to the App you can also disable the notifications in your devices system settings (via App permissions) or in your App settings.
 
Links to social media platforms and share links
Our website contains hyperlinks that lead to pages of social media platforms (e.g., Facebook, Instagram, X/Twitter) or allow you to share content on those platforms.

No data is transmitted to social media platforms before you click such a link. Only when you click a link your browser will be redirected to the respective social media platform. The providers of the platform are therefore responsible controllers under the GDPR, and the respective privacy notices apply.

We may measure how often such links are clicked in order to improve our content. This is done without creating user profiles and without enabling us to identify individual users. This evaluation is based on our legitimate interest pursuant to Art. 6 para. 1 s. 1, lit. f GDPR.

4. Retention and erasure of your Personal Data

We store your Personal Data for as long and to the extent required for the purposes named in this Data Protection Information.

As soon as the data for the purposes named in the respective section is no longer required, we restrict the processing of that data and keep this restricted data only further for the length of the time in which you can assert claims against us, respectively we can claim them against you (i.e. the statutory period of limitations which is generally three years, starting with the end of the year in which the claim arises).

In addition, we store your Personal Data for as long as and insofar as we are legally obliged to do so. The German Commercial Code, the Fiscal Code and the Money Laundering Act, among others, impose corresponding duties of proof and retention. The retention period could be up to ten years.

5. Transfer of Personal Data and the categories of Recipients

We may transfer / disclose your Personal Data to the following categories of Recipients:

IT service providers who provide the platforms, databases and tools for our services and provide analyses of user behavior on our websites.

In connection with Google Analytics, including tags and cookies, your Personal Data may be transferred to the USA.

For the analysis of your behavior on our website, we might transfer your personal data to specialized service providers in third-party countries, if necessary.

In order to send “push notifications” we transfer your personal data to OneSignal in the USA.

In addition to this, we only transfer your personal data if we are legally obliged to forward such data (e.g. to the police authorities within the scope of criminal investigations or to the data protection supervisory authorities). This transfer of personal data is necessary for compliance with a legal obligation (Legal basis: Art. 6 para. 1 s. 1, lit. c GDPR).

We ensure that suitable safeguards (e.g., certification in the EU-U.S. Data Privacy Framework adopted by the EU Commission, conclusion of applicable EU Standard Contractual Clauses and, if necessary, additional measures) for adequate data protection are in place, if your personal data is disclosed to any recipients mentioned above, which are established outside the EU/EEA.

6. Right to object to data processing based on legitimate interests

If we process your Personal Data within the meaning of the sections above on the basis of these legitimate interests (Art. 6 para. 1 s. 1, lit. f GDPR), you can – without prejudice to the specific opt-out options provided in the above sections – object to the data processing at any time on grounds relating to his or her particular situation. We will comply with your objection, unless there are important reasons to the contrary within the meaning of Art. 21 GDPR. Please send your request to dataprotection[at]puma.com.

If you object to the data processing, we process your Personal Data collected in this context to answer your inquiry. Your Personal Data will be processed in order to fulfil a legal obligation on (legal base: Art. 6 para. 1 s. 1, lit. c GDPR).

7. Right to withdraw consent

If you have given us your consent for the processing of your Personal Data, you can withdraw this consent at any time. The withdrawal of your consent is effective for the future and shall not affect the lawfulness of processing based on consent before its withdrawal. Please send your withdrawal of consent to dataprotection[at]puma.com. There may also be additional possibilities to withdraw consent, e.g. by clicking on the unsubscribe button in a newsletter email.

If you withdraw your consent, we process your Personal Data collected in this connection to answer your inquiry. Your Personal Data will be processed in order to fulfil a legal obligation (legal base: Art. 6 para. 1 s. 1, lit. c GDPR).

8. Your other data protection rights

In accordance with the GDPR, you may demand at any time that we:

provide you with information on your personal data that we process (Art. 15 GDPR),

rectify any of your personal data (Art. 16 GDPR),

erase (Art. 17 GDPR), restrict (Art. 18 GDPR) and/or export (Art. 20 GDPR) any of your personal data stored on our systems.

Please send your request either by email to dataprotection[at]puma.com or in writing to PUMA SE, PUMA Way 1, 91074 Herzogenaurach, Germany.

If you exercise these rights against us, we will process your personal data in order to respond to your request. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR).

Irrespective of your above mentioned rights, you can lodge a complaint with a data protection supervisory authority, if you are of the opinion that the processing of your personal data by PUMA violates the GDPR (Art. 77 GDPR).

9. Changes to this Data Protection Information

The provisions of this Data Protection Information apply in the version in force at the time our website is visited.

We reserve the right to supplement and modify the content of this Data Protection Information. The updated Data Protection Information applies from the time in which it was published on our websites.

In case of substantive or material changes to the Data Protection Information, especially changes that affect the processing of your personal data already collected by us, we will inform you in advance (e.g. by email).